Falhas do tipo CWE-428

358 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2025-64151HIGHMultiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write EPSS 0.2%CVE-2025-57699HIGHWestern Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user wEPSS 0.2%CVE-2025-62225HIGHOptical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write perEPSS 0.2%CVE-2016-20086HIGHVembu StoreGrid 4.0 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2016-20085HIGHRealtek High Definition Audio Driver 6.0.1.6730 Privilege EscalationEPSS 0.2%CVE-2020-36934HIGHDeep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service PathEPSS 0.2%CVE-2024-57276HIGHIn Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability. This service is configEPSS 0.2%CVE-2023-2685HIGHUnquoted Service Path in ABB AO-OPCEPSS 0.2%CVE-2019-25286HIGH_GCafé 3.0 - 'gbClienService' Unquoted Service PathEPSS 0.2%CVE-2021-47823HIGHePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service PathEPSS 0.2%CVE-2020-37064HIGHEPSON EasyMP Network Projection 2.81 - 'EMP_NSWLSV' Unquoted Service PathEPSS 0.2%CVE-2020-36935HIGHKMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service PathEPSS 0.2%CVE-2020-37048HIGHIskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service PathEPSS 0.2%CVE-2020-36952HIGHIObit Uninstaller 10 Pro - Unquoted Service PathEPSS 0.2%CVE-2020-37045HIGHNetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service PathEPSS 0.2%CVE-2019-25274HIGHProShow Producer 9.0.3797 - Unquoted Service PathEPSS 0.2%CVE-2021-47803HIGHiFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service PathEPSS 0.2%CVE-2021-47826HIGHAcer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service PathEPSS 0.2%CVE-2019-25287HIGHAdaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service PathEPSS 0.2%CVE-2021-47847HIGHDisk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service PathEPSS 0.2%